Member-only story
Claude Code Mods: Deny Rules, claude plugin validate, and a Mod Review Gate for Teams
A mod runs inside the harness process with your permissions. Here is a review gate you can run today on a private plugin marketplace
A mod meant to protect a project from rm -rf can run rm -rf itself, and in Claude Code’s default configuration it won’t ask anyone first. This is not an incident report but a capability that Anthropic’s documentation names outright.
A mod (a plugin whose code runs inside the Claude Code process) is a JavaScript or TypeScript function executed inside the harness, with the user’s permissions and outside the Bash sandbox. A mod’s code has no file or network access of its own, and all of its privileged power flows through the $ API, which is why it can be enumerated. Deny rules evaluate tool calls that Claude proposes, and they don’t evaluate the mod’s own file reads or program launches at all. This is pure control-plane code: something that executes, not text a model can ignore.
Must-install lists sell mods, critics describe them as a risk, and few texts tell an architect how to admit a mod into a team. None of the sources I reviewed documents a destructive mod in circulation.
